[acamarata]

Rows

Row	Result
D-0763	Fixed. Run now removes .nself/import/<run>/stage when report.Wrote is false, not only on pass. A written, failed run and --keep-stage still keep it. report.json always stays. Test TestRefusedImportRemovesStage fails on main, passes here.
D-0785	Fixed. New importer.SafeError / NewSafeError(code, what). publicError passes it through unchanged (also when wrapped) for E517/E518/E520/E521 when the text is plain (<=300 chars, valid UTF-8, no control or bidi characters). Sources build it only from fixed templates plus checked values. AllowMessages stays for static texts.
D-0764	Fixed. Input.Handoff carries Detect's verified portable.Reader to Extract (nself source), and Extracted.Staged carries the verified staged reader to runBundle, so the stage is opened once and the source is opened once. Hash passes drop from about five to three (Detect, the streaming copy, the staged re-open). A handed-off reader keeps its identity snapshot and the copy still hashes every member, so a bundle altered after Detect is still refused with E516 (tested).
D-0768	Fixed. Digit-only Supabase phones get a + prefix (done in Go via a new variadic adjust hook on postgres.WriteUsers, so it is unit-tested). The duplicate-phone preflight uses the same normalisation. is_anonymous users are read when the column exists and listed in users.anonymous in the report (new field, omitted when empty, golden files unchanged). Wiki page updated.
D-0888	Fixed with the first option in the row (non-persisting check; the rollback guard is not weakened). license.WithReadOnlyClock(ctx): cacheTrust still verifies the entry and refuses a clock behind the stored mark, but does not raise license.clock. gatherPlan (update --plan/--yes planning) uses it. Needs the licence owner's confirmation at review: only the plan path is switched over; other licence checks still advance the clock. bundleEntitledFromCache/Grace and cacheTrust gained a ctx parameter.
D-0781	Not touched (see below).

D-0781 not done

The preferred fix needs collection-group runQuery (allDescendants, no collectionId at the root) and a pinned readTime. Neither can be exercised here (no Firestore or emulator on the worker), and readTime is limited to the last hour without PITR, so it would break the hours-long exports the row is worried about. Per-pattern counts for nested collections also cannot come from one collection-group COUNT when two parents share a collection id. This needs a design decision and a run against the emulator.

Checks run

• go build ./... ok
• go vet ./internal/importer/... ./internal/license/... ./cmd/commands/ ok
• go test ./internal/importer/... ./internal/license/... ./internal/plugin/... ./internal/bundle/... ./cmd/commands/ -count=1: 6359 passed in 31 packages
• Tests that need Docker or a live Postgres were not run (none on the worker); the Supabase user SQL change is covered by composition tests only.

[acamarata]

Rebased onto origin/main and fixed the three failing ratchets from the review:

• Split internal/license/cache_entry.go (305 lines) into cache_entry.go (70 lines, type + age helper) and cache_verify.go (238 lines, signature/binding/trust checks) so TestFileSizeBudgetNotExceeded passes without raising the budget.
• Regenerated command schemas via make schemas and refreshed .github/openapi.json via tools/openapigen so TestSchemasAreCurrent, TestCommittedSchemasAreCurrent and TestOpenAPIIsCurrent pass on the rebased head.

Verified locally with go test -mod=vendor -run 'TestFileSizeBudgetNotExceeded|TestSchemasAreCurrent|TestCommittedSchemasAreCurrent' ./internal/repoqa/... ./tools/schemagen/....

Note: TestPackageSizeBudget (internal/plugin ceiling) still fails on this branch but is pre-existing on origin/main — this PR introduces zero diff in internal/plugin/ and does not touch that package.

[acamarata]

Review fixes pushed. The wiki pages for nhost, Hasura Cloud and Postgres said a failed run keeps its stage; they now use the Supabase wording (kept only after a write, removed when refused before any write). That matches internal/importer/run.go (stage is removed unless the run wrote and failed, or --keep-stage). Firebase and Appwrite pages have no such sentence. trust_test.go failure message restored to cacheTrust(good). Checked: no stale wording left in .github/wiki, go test ./internal/license/ passes.

[acamarata]

Rebased onto origin/main (clean) and fixed the nself-ci failure. TestApplyEntitlementRefreshFailureIsPublished faked a build that wrote the literal published as docker-compose.yml. Under NSELF_V15=1 (set in nself-ci.yml) the second Apply reads that file for the lock pins and failed to parse it. The fake now writes valid compose (services: {}). Reproduced with NSELF_V15=1 before the change (same error as the hosted run), passes after. Whole module green in default mode; no ratchet changed.

[acamarata]

Rebased onto origin/main (6 new commits). Conflicts were in generated files only (.github/facts.json, .github/wiki/MCP-Tools.md); took main's side, then regenerated both (make cmd-inventory, wikigen) in 48aaf7b. schemas-check, wiki-check, mcpgen golden, importer, license, reconcile, repoqa, cmdregistry, tools and cmd/commands tests pass.

[acamarata]

Rebased onto origin/main and resolved merge conflicts in .github/wiki/Drills.md, scripts/drill/legs/clean-host/lib.sh, scripts/drill/legs/clean-host/run, scripts/drill/legs/upgrade-continuity/run, and scripts/drill/stack-lock.sh. Kept both sides' intent: HEAD's stack-lock at /tmp with atomic takeover mutex, bounded probes, freshness fields, retrying row_digest, and stricter curl; incoming's importers drill row, bytes wording, and simpler drop-table check. Shellcheck passes on touched scripts. Force-pushed to dw9-cli-13 (be898fd).